From f5a6a57ce6ba28bc18d4a208c65ee0f124e4943e Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Thu, 4 Sep 2025 22:00:50 +0200 Subject: [PATCH] completed the relaying page --- .../docs/ispmail-trixie/180-relaying.mdx | 29 ++++++++++--------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/src/content/docs/ispmail-trixie/180-relaying.mdx b/src/content/docs/ispmail-trixie/180-relaying.mdx index ab5582c..958c956 100644 --- a/src/content/docs/ispmail-trixie/180-relaying.mdx +++ b/src/content/docs/ispmail-trixie/180-relaying.mdx @@ -338,12 +338,14 @@ As a result you will get the exact same string you used above with "AUTH PLAIN". Please note that there are two different TCP ports on a mail server that speak SMTP: -| Service name | SMTP | Submission | Submission TLS | +| Service name | SMTP | Submission | Submissions | | -------------------- | ------------------------------------ | ---------------------------- | --------------------- | | TCP Port | 25 | 587 | 465 | | Transport encryption | **Off** at first. STARTTLS optional. | **Off**. STARTTLS mandatory. | TLS all the time | | Authentication | Optional [^1] | Mandatory | Mandatory | -| Meant for | Servers | Humans | Humans | +| Accepted sender | Anyone | Our own users | Our own users | +| Accepted receivers | Our own users | Anyone | Anyone | +| Meant for | Servers | Our users | Our users | | Used by | Mail transport agent (MTA) | Mail user agent (MUA) | Mail user agent (MUA) | | Your home ISP | may block this port | will allow this port | will allow this port | @@ -354,8 +356,10 @@ Please note that there are two different TCP ports on a mail server that speak S required this setting to be `on` would be if your server were a relay (_smarthost_) for other servers using authentication.. -I hope that makes the distinction a bit clearer. Our human users will have to use the _submission_ service either on 587 -or 465. +I hope this helps clarify the distinction. Human users must use the submission service on either port 587 or 465. The +key difference is that connections on port 587 start unencrypted, and the email client must issue the STARTTLS command +to enable encryption. In contrast, port 465 requires the email client to use TLS encryption right from the first byte of +communication. ## Configure the submission service @@ -529,21 +533,18 @@ The server should rightfully reject that wrong sender: <~ * 553 5.7.1 john@example.com: Sender address rejected: not owned by user john@example.org ``` ---- - -Of course you can test your new security feature in the Roundcube web mail interface as well. In Settings/Identities you -can create another sender email address as in: +You can also see that restriction in action by adding a fake persona in Roundcube and try to use it. In +Settings/Identities you can create another sender email address as in: ![Selecting another identity in Roundcube](images/relaying-roundcube-selecting-identity.png) -With this wrong sender address any email should get rejected. Your mail.log would read something like: +With this wrong sender address any email should get rejected. Roundcube will show you an error that is generated by +Postfix: ``` -NOQUEUE: reject: RCPT from foo.bar\[…\]: - 553 5.7.1 : - Sender address rejected: - not owned by user john@example.org; - from= to=<…> +553 5.7.1 : +Sender address rejected: +not owned by user john@example.org ```